Kibana查询语法

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# where the status field contains active
status:active

# where the title field contains quick or brown. 
# If you omit the OR operator the default operator will be used

title:(quick OR brown)
title:(quick brown)

# where the author field contains the exact phrase "john smith"
author:"John Smith"

# where any of the fields book.title, book.content or 
# book.date contains quick or brown 
# (note how we need to escape the * with a backslash):

book.\*:(quick brown)

# where the field title has any non-null value:
_exists_:title

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

单个字符
   te?t

多个字符
   test*
   
通配匹配比较耗费内存，性能较差
\*被重写为了exists查询
field:* 会匹配为空的情况
{
  "field": ""
}
不会匹配
{
  "field": null
}
前缀匹配*ing操作很重
可以把allow_leading_wildcard设置为flase来关闭前缀匹配

1
2

# 以/开始, 后接re表达式
name:/joh?n(ath[oa]n)/

1
2
3

相似匹配
roam~0.8，即表示差别小于0.2，相似度大于0.8才算匹配
该查询将寻找类似“foam”和“roams”等的词语。也可以说是相似度查询。

1
2
3
4

Lucene支持指定距离查询，你可以使用波浪号“~”加数字在查询词后。
举例来说搜索“apache”和“jakarta”距离10个字符以内，你可以使用如下语法：
   
"jakarta apache"~10 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

# All days in 2012:
date:[2012-01-01 TO 2012-12-31]

# Numbers 1..5
count:[1 TO 5]

# Tags between alpha and omega, excluding alpha and omega:
tag:{alpha TO omega}

# Numbers from 10 upwards
count:[10 TO *]

# Dates before 2012
date:{* TO 2012-01-01}
# Curly and square brackets can be combined:
# Numbers from 1 up to but not including 5
count:[1 TO 5}

# Ranges with one side unbounded can use the following syntax:
age:>10
age:>=10
age:<10
age:<=10

1
2
3

# 不同的查询词设置不同的权重
"john smith"^2   
(foo bar)^4

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# +必存在 -必须不存在
# The preferred operators are + (this term must be present) 
# and - (this term must # not be present).
# All other terms are optional. For example, this query:

quick brown +fox -news

# states that:
# fox must be present
# news must not be present
# quick and brown are optional — their presence increases the relevance

1
2

(quick OR brown) AND fox
status:(active OR pending) title:(full text search)^2

1
2
3

# (1+1)=2, you would need to write your query as 
# \(1\+1\)\=2
+ - = && || > < ! ( ) { } [ ] ^ " ~ * ? : \ /